Comprehensive platform for enterprise proxy management with modern UI and powerful automation.
Typed models and field metadata are generated from each Envoy version's protobuf definitions. Create Listeners, Clusters, Endpoints, and Routes with typed fields and validation.
Interactive visual diagrams display relationships between Envoy components. Understand resource dependencies, data flow, and troubleshoot configurations.
Guided wizards that build a complete set of resources for common Envoy setups, such as an HTTP proxy with or without EDS and a TCP proxy. Create and manage your own scenarios too.
A lightweight agent that manages Envoy on every edge host. Automatic registration, health monitoring, log export to Syslog/ELK, and seamless integration with the control plane.
Complete implementation of xDS (ADS, CDS, EDS, LDS, RDS, VHDS). Delta xDS support for efficient incremental configuration updates.
Validation in the editor and again on the server ensures configurations are correct before deployment. Catch errors early and prevent misconfigurations.
Draft mode for safe configuration changes. Save incrementally and publish bulk updates atomically when ready. Every change is recorded in the audit log.
Manage multiple Envoy versions side by side from a single interface — new releases are added continuously. Intelligent version-based routing with seamless version upgrade capability.
Organize configurations by teams, environments, or customers. Complete resource isolation with 4-tier RBAC (Owner, Admin, Editor, Viewer).
Intelligent automation meets cloud-native architecture.
Turn live proxy traffic into a continuously-scored inventory of every API you expose. Find shadow endpoints, missing auth, and PII leaks — and export the whole surface as OpenAPI.
A per-edge ext_proc sidecar that enforces API security right in the request path: WAF, authentication, rate limiting, and bot defense — twelve engines you compose per route and roll out safely from detect to block, plus built-in data-loss prevention.
Bring your own OpenRouter API key and choose any AI model. Ask for a review of a resource and its dependencies, or of selected logs, and get troubleshooting suggestions on demand.
An in-cluster discovery agent reports your Kubernetes nodes, and Elchi keeps Endpoint resources in sync with the node IPs (NodePort-style), across several clusters.
Automated certificate lifecycle management with ACME protocol support for Let's Encrypt and Google Trust Services. DNS-01 challenge verification with auto-renewal.
Enterprise GSLB with intelligent health probing, automatic failover, and region-scoped answers: each regional DNS node serves only the healthy IPs tagged for its region. Integrates with CoreDNS for dynamic DNS responses based on endpoint health.
Advanced capabilities for security, monitoring, and operational excellence — all integrated into a unified platform.
Integrated OWASP Core Rule Set (CRS) with customizable directive sets, per-authority rules, and comprehensive filtering by severity, phase, and paranoia level.
Pre-built scenario workflows with step-by-step wizards for common Envoy configurations. Execute, test, and deploy configurations efficiently.
See every Kubernetes cluster that reports through the discovery agent: its status, when it was last seen, and which endpoints use it.
Complete audit trail for all user actions, configuration changes, and system operations. Filter by date, action type, user, and resource.
Interactive charts for downstream, upstream, and listener metrics. Custom time ranges, metric grouping, and auto-refresh.
Real-time service logs with JSON parsing, HTTP access log detection, and intelligent log analysis for pattern detection and troubleshooting.
Export a project's configuration, services and certificates to one JSON file, validate it, and import it into the same or another installation.
Move a listener and the resources it depends on from one Envoy version to another, then cut over with a hot restart.
Ship logs to external systems with Filebeat (Elasticsearch or Logstash) or rsyslog. Centralize log management and integrate with your existing observability stack.
View detailed metrics both on the platform and through Grafana integration. Monitor performance, traffic patterns, and system health in real-time.
Integrate with your existing LDAP/Active Directory infrastructure. Centralized user authentication and authorization for enterprise deployments.
Automated certificate lifecycle management with ACME protocol support for Let's Encrypt and Google Trust Services with DNS-01 challenge.
Continuously discover every API your proxies expose, score each endpoint for threat and exposure, and catch drift, missing auth, and PII leaks before they become incidents.
Enrich traffic analytics with reputation feeds and GeoIP databases. Flag malicious sources and resolve clients to country, ASN, and geography across dashboards.
Long-running operations run asynchronously with full visibility. Track snapshot updates, WAF propagation, ACME verification, and version upgrades with retry support.
TOTP-based multi-factor authentication with QR enrollment and backup codes. Admins can enforce 2FA and reset it for locked-out users.
Pair two Elchi OS appliances so they share VIPs active/passive. The boxes elect the active member themselves, the standby runs the same Envoys warm, and a failed active is replaced in about two seconds on plain L2 (over BGP, with BFD on the neighbours).
Run multiple controllers and control-planes with leader election and live topology visibility. Standby nodes hydrate from registry snapshots for resilient operations.
Watch a listener as it runs. Requests sampled from the access log flow from the clients through connection managers, domains, routes and clusters to the endpoints — each placed where Envoy ended it — with rates, p99 and 5xx origin from metrics every 5 seconds.
Answers about the whole project in one place: what needs a look first, which listener serves which domain and where it goes, TLS and WAF coverage per filter chain, unused resources, the fleet and recent changes.